circle-ir-ai 4.16.1 → 4.16.3

package/CHANGELOG.md

@@ -7,6 +7,56 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
+## [4.16.3] - 2026-09-24
+
+### Changed
+- **circle-ir 4.9.25 → 4.9.26.** Go/C# precision + recall batch. Not a lockstep tag — one of
+  these fixes a bug that shipped in our current pin.
+  - **cognium-dev#472 — Go taint no longer leaks to a same-named local in another function.**
+    The argument-expression matcher links source to sink by variable name, and its same-method
+    gate compared method *names*: it never ran for assignment-shaped sources (`a := os.Args`) and
+    could not separate two functions sharing a name (`(*A).ServeHTTP` / `(*C).ServeHTTP`). So a
+    `b := []byte("x")` in one function inherited the taint of `b, _ := io.ReadAll(r.Body)` in
+    another. **This shipped in 4.9.23–4.9.25 via the #459 `r.Body` source — i.e. it is live in our
+    4.16.2 pin.** Go now compares the enclosing function by line range; package-level sources stay
+    unscoped and closures share their handler's scope. 36 flows removed across 175 Go repos
+    (33 re-attributed to the correct source, 3 cross-function sinks dropped).
+  - **cognium-dev#343** — Go `bufio.NewScanner`/`NewReader` over the request body: `sc.Text()`,
+    `sc.Bytes()`, `br.ReadString(…)` now seed `http_body`.
+  - **cognium-dev#339** — C# bare expression-statement sinks with an inline request read
+    (`File.Create(Path.Combine(dir, file.FileName));`) were silent while the assigned form fired.
+  - **cognium-dev#473** — `initParser` cached a *failed* init forever, so one bad `wasmPath` or a
+    transient fetch failure poisoned every later `initParser`/`initAnalyzer` call in the process.
+
+  **Baseline impact (expected, not regression):** Go counts move in **both** directions. #472
+  re-attributes source lines, so a baseline keyed on `sink@source->sink` shows one removal plus one
+  addition per affected flow; #343/#339 add genuinely new Go/C# findings. No API or output-shape
+  change. Lockfile refreshed; single circle-ir copy verified.
+
+
+## [4.16.2] - 2026-09-24
+
+### Changed
+- **circle-ir 4.9.23 → 4.9.25.** Two `analyzeProject` robustness fixes from 4.9.24, both of
+  which turned a scannable repo into a hard failure, plus the 4.9.25 lockstep tag (no library
+  change). Neither changes detection on ordinary source.
+  - **cognium-dev#458 / #420 — a Python starred parameter no longer fails the project analysis
+    closed.** `CrossFileResolver` interpolated a method parameter straight into `\b<name>\b`, so
+    `*args` / `**kwargs` arrived with their stars, `*` read as a quantifier, the pattern failed to
+    compile ("Nothing to repeat") and the whole `analyzeProject` call failed. This is the direct
+    cause of a chunk of the `meta.crossFile.error` rows our #482 pass reports — 42 errors on the
+    485-repo Cisco sweep of 2026-09-23, with urllib3 / fickling / haystack among the 6-in-95
+    upstream measured. Expect that error count to drop on the next sweep. Per-file `analyze()` was
+    never affected.
+  - **cognium-dev#460 / #421 — minified / bundled files no longer wedge the project scan.**
+    `analyze()` now returns a minimal IR for any file whose longest line exceeds 10,000 characters.
+    Our own `crossFile` guard (#482) already skipped these at a **tighter** 5,000 characters, so
+    this is belt-and-braces for that path — but it also protects every *other* `analyzeProject`
+    caller, which our guard never covered. NodeGoat drops ~56 s → ~0.4 s upstream.
+
+  Lockfile refreshed; single circle-ir copy verified.
+
+
 ## [4.16.1] - 2026-09-23
 
 ### Fixed

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "circle-ir-ai",
-  "version": "4.16.1",
+  "version": "4.16.3",
   "description": "LLM-enhanced SAST analysis built on circle-ir",
   "main": "dist/index.js",
   "module": "dist/index.js",
@@ -69,7 +69,8 @@
     "benchmark:csharp": "tsx benchmarks/runners/run-csharp.ts",
     "benchmark:csharp-product": "tsx benchmarks/runners/run-csharp-product.ts",
     "benchmark:csharp-juliet": "tsx benchmarks/runners/run-csharp-juliet.ts",
-    "benchmark:vuln-localization": "tsx benchmarks/runners/run-vuln-localization.ts --limit 20"
+    "benchmark:vuln-localization": "tsx benchmarks/runners/run-vuln-localization.ts --limit 20",
+    "test:coverage": "vitest run --coverage"
   },
   "keywords": [
     "sast",
@@ -103,7 +104,7 @@
     "@ax-llm/ax": "^20.0.0",
     "@cognium/project-profile-detect": "^1.1.0",
     "@mastra/core": "^1.18.0",
-    "circle-ir": "4.9.23",
+    "circle-ir": "4.9.26",
     "minimatch": "^10.2.5",
     "p-queue": "^9.1.0"
   },